How we look after your details

Who we are

Hello Santa Claus is run by Jay Howells, a sole trader, trading as Hello Santa Claus and 099C.
Address: 8 Morlais Street, Pentrebach, Merthyr Tydfil, CF48 4BS, United Kingdom.
Email: [email protected].

We are the "data controller" for the details you give us. In practice that means me, Jay Howells: I run Hello Santa Claus myself and I am personally responsible for how your family's details are used and protected. Any question about your data comes straight to me. We are registered with the Information Commissioner's Office (ICO), registration number ZC267762.

What we collect

• About you: your name and email address, and (if you tell us) how you heard about us.
• About each child: their first name, how to say it, what they love, something they've done this year, and — only if you choose — a photo.
• About your order: what you ordered, the price, any discount code, which of our links you arrived from (for example, a Facebook post), when you agreed to our terms, and whether payment succeeded. We never see or store your card details.

What we use it for, and why we're allowed to

• Making and delivering your video, and putting it right if something's wrong — because you've asked us to (our contract with you).
• Keeping a basic record of the sale (order number, date, amount) — because the law requires businesses to keep accounting records.
• Answering your messages — if you email us, message us, or use our contact form — a legitimate interest in replying to you.
• Counting which adverts and links bring orders (for example "12 orders from Facebook") — a legitimate interest in running the business sensibly. We only look at totals, never at individual families.
• Emailing you about Hello Santa Claus before future Christmases — if you bought from us and didn't tick the "please don't email me" box. This is based on our legitimate interest in letting past customers know about Hello Santa Claus, under the rules that allow businesses to email their own customers about similar things they've bought (the "soft opt-in"). Every such email has an unsubscribe link, and you can also just tell us. Your order and video emails are separate and are always sent.

Children's details are given to us by their parent or guardian, or by someone ordering with their permission (for example a grandparent), and are used only to make that family's video. A photo is only placed in the video as you sent it — we don't use photos to recognise or identify anyone, and we don't run face recognition on them. We never sell your details, use them for advertising, or use your children's details for anything else.

Who helps us

• Stripe takes your payment. Your card details go straight to Stripe; we never see them.
• ElevenLabs turns Santa's words into speech. It receives only the words Santa says — your children's first names and the details you gave — never their photos, your email address or your name. ElevenLabs stores data in the United States. For people in the UK it protects that transfer using the UK Extension to the EU–US Data Privacy Framework (and, where that doesn't apply, the UK's approved contract clauses), and keeps data only as long as it needs to, as set out in ElevenLabs' privacy policy.
• Cloudflare connects visitors to our website and stores the finished video so we can send you a private link.
• Google (Gmail) sends your confirmation and your video link, and receives your replies.
• Google Fonts supplies the lettering on our website, so your browser connects to Google to fetch it (Google sees your IP address, as with any website visit).

Photos never leave our own computer except inside your finished video. Making the video happens on our own computer in the UK.

How long we keep it

• Photos, the video and your children's details: deleted 30 days after your video is delivered. If you ask us to remake your video, the 30 days start again from when we send the new one, so we can put it right.
• Backups: we keep backup copies of our order records (which include your name, email address and your children's details, but never photos or videos) on our own computer for 14 days, then they're deleted automatically. So details deleted from our records are gone from every backup 14 days later.
• If you don't finish paying: everything you entered, photos included, is deleted within 24 hours.
• The basic sales record (order number, date, amount, discount, where the order came from): kept for as long as HMRC requires business records to be kept — at least five years after the 31 January Self Assessment deadline for the tax year of the sale (so roughly six to seven years). This record contains no photos and no video.
• Your customer record (your name, email address, the dates of your orders and whether you're happy to hear from us): kept for 24 months after your most recent order, then deleted. If you unsubscribe, we keep only your email address on our "do not email" list.
• Next Christmas: for Christmas 2026 we don't keep your children's details for next year — everything about making your video is deleted 30 days after delivery.

Emails about future Christmases

When you buy, we keep your name and email address in a customer record that is kept apart from your children's details. Your children's names, photos and other details are never kept for this — they're deleted 30 days after delivery like everything else about making the video.

If you'd rather not hear from us, tick "please don't email me" when you order, use the unsubscribe link in any of these emails, or email us. Once you've said no, we keep just your email address on a "do not email" list so we never contact you by mistake. You can also ask us to delete your customer record altogether.

Messages and the contact form

If you use our contact form, your name, email address and message are emailed to our own inbox ([email protected]) so we can reply. The website doesn't keep a copy. We keep the email only as long as we need it to deal with your question, and delete it within 12 months. If you message us on a messaging app, that app's own privacy policy also applies.

Cookies

Our website doesn't set any cookies of its own and doesn't use tracking or advertising cookies. Cloudflare may set a strictly necessary security cookie to protect the site from attacks. If you came from one of our links (for example from Facebook), that's noted on your order, not stored on your device.

Your rights

You can ask to see, correct or delete the information we hold about you and your children at any time — email us, or reply to any of our emails. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.